release.yml

name: Build and Release AgentBridge

# The release is now AUTOMATIC: pushing master with IsPrerelease=false in AgentBridge.csproj
# (in the pushed commit) triggers the wait for the dependency NuGet packages, the build of the
# 5 platform archives and the GitHub release — the tag v1.yy.MM.dd is created on the fly. No
# tag push and no release.ps1 invocation are needed anymore. With IsPrerelease=true, or when
# today's tag already exists, the run is skipped. See docs-dev/RELEASING.md.
on:
  push:
    branches: [master]
  workflow_dispatch:

permissions:
  contents: write
  # DO NOT add a "workflows" key here — it is NOT a valid value in a workflow's permissions
  # block (only PATs / GitHub Apps have it). Doing so makes the whole file invalid and every
  # run fails with 0 jobs ("Invalid workflow file ... Unexpected value 'workflows'",
  # 2026-09-04). If the tag-pin push is ever refused for a workflow-file change, pin the tag
  # to a commit whose .github/workflows matches the default branch instead.

# Serializes runs of this workflow per branch: with cancel-in-progress: false a NEW run (the
# gate-restore push, a manual push during the build) never cancels the QUEUED or RUNNING
# release run. The back-to-back double push of release.ps1 raced GitHub's Actions queue on
# 2026-08-26: the runs were created in inverted order and the gate-off (release) run was
# failed while still queued — no release was produced. The restore commit carries [skip ci]
# (release.ps1) so it creates no run at all; this group is the structural guard for every
# other quick double push.
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # Release gate: when IsPrerelease=true in AgentBridge.csproj the version carries a
  # "-prerelease" suffix and no GitHub release is created. See AGENTS.md.
  check-version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.ver.outputs.version }}
      do_release: ${{ steps.gate.outputs.do_release }}
      need_nuget_wait: ${{ steps.nuget.outputs.need_nuget_wait }}
      wait_packages: ${{ steps.nuget.outputs.wait_packages }}
    steps:
      - uses: actions/checkout@v4
        with:
          path: AgentBridge
      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'
      - name: Detect version + release gate
        id: ver
        shell: bash
        run: |
          # -getProperty:Version prints the raw value (single property) — grep handles both
          # raw ("1.26.08.09") and JSON ({"Properties":{"Version":"..."}}) output shapes.
          VER=$(dotnet msbuild AgentBridge/AgentBridge.csproj -getProperty:Version -nologo | grep -oE '[0-9]+(\.[0-9]+)*(-[a-z0-9]+)?' | head -n1)
          echo "version=$VER"
          # IsPrerelease is the source of truth for the gate (the "-prerelease" suffix derives
          # from it in the csproj). Read the property directly: if Version ever fails to carry
          # a full date (e.g. an empty <ReleaseDate> makes the grep above extract a bare "1"),
          # the suffix-based check alone would silently treat a prerelease push as a release
          # and run the whole build for a garbage version (2026-09-04 incident).
          PREREL=$(dotnet msbuild AgentBridge/AgentBridge.csproj -getProperty:IsPrerelease -nologo | grep -oE 'true|false' | head -n1)
          echo "prerelease=${PREREL:-false}" >> "$GITHUB_OUTPUT"
          echo "version=$VER" >> "$GITHUB_OUTPUT"
      - name: Decide whether to release
        id: gate
        shell: bash
        # The checkout above uses path: AgentBridge, so git must run from inside the repo
        # (the workspace root is not a git repository — 'origin' does not exist there).
        working-directory: AgentBridge
        env:
          VERSION: ${{ steps.ver.outputs.version }}
          PRERELEASE: ${{ steps.ver.outputs.prerelease }}
        run: |
          if [ "$PRERELEASE" = "true" ]; then
            echo "IsPrerelease=true -> prerelease build, no GitHub release"
            echo "do_release=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          if git ls-remote --tags origin "refs/tags/v$VERSION" | grep -q .; then
            echo "Tag v$VERSION already exists -> no second release for this version"
            echo "do_release=false" >> "$GITHUB_OUTPUT"
          else
            echo "do_release=true" >> "$GITHUB_OUTPUT"
          fi
      # NuGetWait marker (set by release.ps1 from its core-repo pre-check): false means no
      # core repo changed since its last tag → the 30-min dependency wait is skipped entirely
      # (release.ps1 aborts the release if a changed core repo has no today-tag, so a missing
      # marker can never silently ship a stale engine).
      - name: Read NuGet wait marker
        id: nuget
        shell: bash
        run: |
          WAIT=$(dotnet msbuild AgentBridge/AgentBridge.csproj -getProperty:NuGetWait -nologo | grep -oE 'true|false' | head -n1)
          echo "need_nuget_wait=${WAIT:-true}" >> "$GITHUB_OUTPUT"
          # release.ps1 narrows the list to the packages whose repos actually changed today,
          # so the wait below exits as soon as THEY propagate (repos that did not change never
          # publish today's version and must not hold the wait). Default = the full set.
          PKGS=$(dotnet msbuild AgentBridge/AgentBridge.csproj -getProperty:NuGetWaitPackages -nologo | head -n1)
          echo "wait_packages=${PKGS:-graphene.aiorchestrator,alltomarkdown,mermaidrendering,graphene.reversemarkdown,uisupportgeneric,systemextra}" >> "$GITHUB_OUTPUT"

  build:
    needs: check-version
    if: needs.check-version.outputs.do_release == 'true'
    name: Build ${{ matrix.rid }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            rid: win-x64
            ext: .exe
          - os: ubuntu-latest
            rid: linux-x64
            ext: ''
          # linux-arm64: supported since KokoroSharp 0.8.4 (phonemizer is the pure-managed
          # MisakiSharp — no espeak-ng binary needed) + the native Microsoft.ML.OnnxRuntime
          # package ships libonnxruntime.so for linux-arm64. Cross-compiled from the x64
          # runner (pure managed code + RID-specific NuGet assets).
          - os: ubuntu-latest
            rid: linux-arm64
            ext: ''
          - os: macos-latest
            rid: osx-x64
            ext: ''
          - os: macos-latest
            rid: osx-arm64
            ext: ''
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: AgentBridge

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      # The dependency NuGet packages are date-versioned (1.yy.MM.dd) and published by each
      # repo's publish.yml when a v* tag is pushed; nuget.org propagation is not instant
      # (official figures: up to 30 minutes). The wait runs ONLY when release.ps1 detected a
      # changed core repo whose today's package is still propagating (<NuGetWait> marker):
      # with no core change the wait would burn 30 minutes for packages that will never exist.
      # release.ps1 ALSO narrows the list (NuGetWaitPackages) to the packages of the repos
      # that changed today, so the window ends as soon as THEY become visible — repos that
      # did not change never publish today's version and would otherwise hold the loop for the
      # full 30 minutes. After the window, a still-missing package is a HARD FAILURE: the wait
      # list only contains packages that SHOULD be at today's version, so expiry means that
      # repo's publish.yml run failed or nuget.org exceeded its documented window — proceeding
      # would restore YESTERDAY's engine and either crash the build with misleading errors
      # (2026-09-06: "CrashReporter does not exist" after the AIOrchestrator publish died
      # waiting for uisupportgeneric) or, worse, ship it silently. Fix the failed publish and
      # re-run release.ps1 — the wait is skipped as soon as the package is visible.
      # The list is ONLY the packages the build actually restores (the Graphene.AIOrchestrator
      # closure + SystemExtra): the tool plugins (DocumentTool, SpreadsheetTool, OfficeTool,
      # PresentationTool, OfficeSupportTool) are NOT build dependencies — they are fetched as
      # self-contained zips from their own GitHub Releases below, never from NuGet.
      - name: Wait for dependency packages on NuGet
        if: needs.check-version.outputs.need_nuget_wait == 'true'
        shell: bash
        env:
          VERSION: ${{ needs.check-version.outputs.version }}
          WAIT_PACKAGES: ${{ needs.check-version.outputs.wait_packages }}
        run: |
          NVER=$(printf '%s' "$VERSION" | awk -F. '{for(i=1;i<=NF;i++){gsub(/^0+/,"",$i); if($i=="")$i=0; printf "%s%s",(i>1?".":""),$i} print ""}')
          echo "Waiting for dependency packages at version $NVER ..."
          for i in $(seq 1 60); do
            missing=""
            for pkg in $(printf '%s' "$WAIT_PACKAGES" | tr ',' ' '); do
              if curl -fsS --max-time 20 "https://api.nuget.org/v3-flatcontainer/$pkg/index.json" | grep -q "\"$NVER\""; then
                echo "$pkg $NVER available (attempt $i)"
              else
                missing="$missing $pkg"
              fi
            done
            if [ -z "$missing" ]; then break; fi
            sleep 30
          done
          if [ -n "$missing" ]; then
            echo "::error::after 30 min these packages are still not at $NVER:$missing"
            echo "::error::this release REQUIRES today's version of every package in <NuGetWaitPackages> — release.ps1 narrows it to the repos that changed today. A missing package means that repo's 'Publish NuGet Package' run failed or nuget.org propagation exceeded its documented window; proceeding would restore yesterday's engine (misleading build crash or silent stale release, 2026-09-06). Check the failed publish run of the repo above, fix it, then re-run release.ps1 — the wait is skipped as soon as the package is visible."
            exit 1
          fi

      # Builds against the published NuGet packages (Graphene.AIOrchestrator 1.* and its
      # dependencies) — the sibling repos are private and never checked out here.
      - name: Publish
        shell: bash
        run: |
          dotnet publish AgentBridge/AgentBridge.csproj -c Release -r ${{ matrix.rid }} \
            --self-contained true \
            -p:PublishSingleFile=true \
            -p:IncludeNativeLibrariesForSelfExtract=true \
            -p:DebugType=None -p:DebugSymbols=false \
            -o ./publish

      # The archive deliberately ships kokoro.onnx (325 MB) plus the KokoroSharp
      # voices/ + voices-zh/ content: single-file publish bundles managed code only,
      # and the TTS endpoints need those assets next to the exe. The native
      # onnxruntime engine is included per-RID by the Microsoft.ML.OnnxRuntime
      # package (libonnxruntime.so / onnxruntime.dll).
      #
      # Tool plugins (Graphene.DocumentTool, Graphene.SpreadsheetTool, Graphene.OfficeTool,
      # Graphene.PresentationTool, Graphene.OfficeSupportTool) are loaded DYNAMICALLY from
      # Tools/ by ToolPluginHost (byte-loaded, never referenced): the single-file publish
      # cannot bundle them. Fetch each plugin's self-contained release zip (plugin + non-host
      # deps, minus the AIOrchestrator graph — produced by the plugin repos' standard
      # plugin-release.yml) from its PUBLIC GitHub release and ship it into publish/Tools/<Plugin>/.
      # Each payload's assets/ (OfficeSupportTool templates, PresentationTool bg/js, icons) is
      # merged into publish/assets/ — the plugins resolve host-level assets from
      # AppContext.BaseDirectory\assets (same convention as the ShipWithAssets dev target and
      # PluginUpdater.MergeHostAssets at update time). NuGet is not part of the plugin
      # deployment channel.
      - name: Fetch tool plugins into Tools/
        shell: bash
        run: |
          mkdir -p /tmp/plugins publish/Tools publish/assets
          for tool in DocumentTool SpreadsheetTool OfficeTool PresentationTool OfficeSupportTool PodcastTool; do
            # Latest release tag via the /releases/latest redirect (no API call, no rate limit).
            tag=$(curl -fsSL -o /dev/null -w '%{url_effective}' "https://github.com/Graphene-Lab/$tool/releases/latest" \
                  | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+[^/]*$' | head -n1 || true)
            if [ -z "$tag" ]; then
              echo "::warning::$tool has no GitHub release yet — tool will be missing from Tools/"
              continue
            fi
            ver="${tag#v}"
            zip="$tool-$ver.zip"
            if ! curl -fsSL -o "/tmp/plugins/$zip" "https://github.com/Graphene-Lab/$tool/releases/download/$tag/$zip"; then
              echo "::warning::cannot download $zip for $tool — tool will be missing from Tools/"
              continue
            fi
            (cd /tmp/plugins && unzip -qo "$zip")
            mkdir -p "publish/Tools/$tool"
            cp -r "/tmp/plugins/$tool/." "publish/Tools/$tool/"
            if [ -d "/tmp/plugins/$tool/assets" ]; then
              cp -r "/tmp/plugins/$tool/assets/." "publish/assets/"
            fi
          done
          # The host always ships the ONNX Runtime engine (per-RID GPU build); a plugin's
          # transitive CPU onnxruntime must never shadow it (version conflicts, CPU-only
          # QwenTTS) — drop the plugin copies here (same rule as ShipOnePlugin.targets).
          find publish/Tools -name 'onnxruntime*' -delete
          find publish/Tools -name 'libonnxruntime*' -delete
          find publish/Tools -name 'Microsoft.ML.OnnxRuntime*.dll' -delete
          find publish/Tools -type f 2>/dev/null | sort || true

      # Windows voice bridge: fetch the AIOffice.VoiceAgent.Win self-contained win-x64 zip
      # from its OWN GitHub release (public repo, same channel as the tool plugins) into
      # publish/voiceagent/ — POST /v1/voice/listen spawns AIOffice.VoiceAgent.Win.exe from
      # there. The local csproj target CopyVoiceAgentOutput covers developer machines that
      # have the sibling VoiceAgent build; CI has no sibling, so this step is what makes the
      # released Windows archive work out of the box. The zip contains a top-level
      # AIOffice.VoiceAgent.Win/ folder (exe + voices/ + kokoro.onnx + native runtimes).
      # Other RIDs do not ship voice recognition (Windows-only feature).
      - name: Fetch VoiceAgent.Win into voiceagent/
        if: matrix.rid == 'win-x64'
        shell: bash
        run: |
          tag=$(curl -fsSL -o /dev/null -w '%{url_effective}' "https://github.com/Graphene-Lab/AIOffice.VoiceAgent.Win/releases/latest" \
                | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+[^/]*$' | head -n1 || true)
          if [ -z "$tag" ]; then
            echo "::warning::AIOffice.VoiceAgent.Win has no release yet — /voice will be unavailable in this archive"
            exit 0
          fi
          ver="${tag#v}"
          zip="AIOffice.VoiceAgent.Win-$ver.zip"
          mkdir -p /tmp/voiceagent
          if ! curl -fsSL -o "/tmp/voiceagent/$zip" "https://github.com/Graphene-Lab/AIOffice.VoiceAgent.Win/releases/download/$tag/$zip"; then
            echo "::warning::cannot download $zip — /voice will be unavailable in this archive"
            exit 0
          fi
          (cd /tmp/voiceagent && unzip -qo "$zip")
          mkdir -p publish/voiceagent
          cp -r /tmp/voiceagent/AIOffice.VoiceAgent.Win/. publish/voiceagent/
          test -f publish/voiceagent/AIOffice.VoiceAgent.Win.exe \
            && echo "voiceagent payload ready: $(du -sh publish/voiceagent | cut -f1)" \
            || echo "::warning::voiceagent/ does not contain AIOffice.VoiceAgent.Win.exe"

      - name: Package
        shell: bash
        run: |
          cd publish
          tar -czf ../agentbridge-${{ matrix.rid }}.tar.gz .
          cd ..
          ls -lh agentbridge-${{ matrix.rid }}.tar.gz

      - name: Upload archive
        uses: actions/upload-artifact@v4
        with:
          name: agentbridge-${{ matrix.rid }}
          path: agentbridge-${{ matrix.rid }}.tar.gz

  # Windows Store MSI: separate job (not inside the win-x64 matrix build) so an
  # installer/WiX problem can never block the archives + GitHub release — and
  # continue-on-error keeps the run green when the MSI step fails (the MSI is an
  # extra delivery channel; the release itself must not depend on it). Payload =
  # the win-x64 archive the build already produced (single source of truth: the
  # exact tree that ships). The Store submission (store-submit job below) points
  # Partner Center at the VPS streaming proxy URL (see tools/store).
  store-msi:
    needs: [check-version, build]
    if: needs.check-version.outputs.do_release == 'true'
    runs-on: windows-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
        with:
          path: AgentBridge

      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - uses: actions/download-artifact@v4
        with:
          name: agentbridge-win-x64
          path: win-payload

      - name: Extract win-x64 payload
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Path payload | Out-Null
          tar -xzf win-payload/agentbridge-win-x64.tar.gz -C payload

      - name: Build Windows Store MSI
        shell: pwsh
        env:
          VERSION: ${{ needs.check-version.outputs.version }}
          # Store policy 10.2.9: the MSI and every PE file it ships must be signed by a
          # certificate chaining to a Microsoft Trusted Root CA. Either a base64 PFX or a
          # thumbprint of a certificate present in LocalMachine\My (token/HSM middleware).
          SIGN_PFX_BASE64: ${{ secrets.SIGN_PFX_BASE64 }}
          SIGN_PFX_PASSWORD: ${{ secrets.SIGN_PFX_PASSWORD }}
          SIGN_THUMBPRINT: ${{ secrets.SIGN_THUMBPRINT }}
        run: |
          $signArgs = @()
          $pfx = $null
          if ($env:SIGN_PFX_BASE64) {
            $pfx = Join-Path $env:RUNNER_TEMP 'store-sign.pfx'
            [IO.File]::WriteAllBytes($pfx, [Convert]::FromBase64String($env:SIGN_PFX_BASE64))
            $signArgs += @('-SignPfx', $pfx)
            if ($env:SIGN_PFX_PASSWORD) { $signArgs += @('-SignPfxPassword', $env:SIGN_PFX_PASSWORD) }
          }
          elseif ($env:SIGN_THUMBPRINT) {
            $signArgs += @('-SignThumbprint', $env:SIGN_THUMBPRINT)
          }
          else {
            Write-Warning 'No signing certificate (SIGN_* secrets) - the MSI will be UNSIGNED and store certification will fail (policy 10.2.9).'
          }
          try {
            & "$env:GITHUB_WORKSPACE/AgentBridge/tools/store/New-StoreInstaller.ps1" `
              -PayloadDir "$env:GITHUB_WORKSPACE/payload" `
              -Version $env:VERSION `
              -OutDir "$env:GITHUB_WORKSPACE/store-msi" `
              @signArgs
          }
          finally {
            # Never leave the private key on the runner disk.
            if ($pfx -and (Test-Path $pfx)) { Remove-Item $pfx -Force }
          }

      - name: Upload MSI
        uses: actions/upload-artifact@v4
        with:
          name: store-msi
          path: store-msi

  # MSIX package for the Microsoft Store — the one Store channel where Microsoft signs for us
  # ("The Microsoft Store will automatically re-sign your MSIX/AppX packages with a Microsoft
  # certificate"), so no code-signing certificate is needed. Same shape as store-msi: separate job,
  # continue-on-error, so a packaging problem can never block or fail the GitHub release.
  #
  # IdentityName/Publisher MUST match Partner Center (View app identity details) or the upload is
  # rejected: set the STORE_IDENTITY_NAME and STORE_PUBLISHER secrets. Without them the package is
  # still built (placeholder identity) and uploaded as a CI artifact, but it is not submittable.
  # The package is intentionally NOT attached to the GitHub release: an unsigned MSIX cannot be
  # sideloaded by users, so publishing it would only create support noise.
  # See docs-dev/STORE-PUBLISHING.md section 8.
  store-msix:
    needs: [check-version, build]
    if: needs.check-version.outputs.do_release == 'true'
    runs-on: windows-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
        with:
          path: AgentBridge

      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - uses: actions/download-artifact@v4
        with:
          name: agentbridge-win-x64
          path: win-payload

      - name: Extract win-x64 payload
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Path payload | Out-Null
          tar -xzf win-payload/agentbridge-win-x64.tar.gz -C payload

      - name: Add MSBuild to PATH
        uses: microsoft/setup-msbuild@v2

      - name: Compile PSF (x64 Release) instead of taking it from NuGet
        shell: pwsh
        run: |
          # Why from source: Microsoft ties PSF telemetry collection to the binaries taken from the
          # NuGet package -- those are built with Microsoft's real telemetry provider GUID injected
          # into include/Telemetry.h (see psf-public-nuget-build.yml in the PSF repo). Building from
          # the repo leaves that provider id as the zeroed placeholder, so the packaged app has
          # nowhere to send telemetry. There is no runtime switch for it: PsfRuntime reads only
          # 'fixups' from config.json.
          $ErrorActionPreference = 'Continue'
          $psfTag = '1.0.240212.1'
          git clone --depth 1 --branch $psfTag `
            https://github.com/microsoft/MSIX-PackageSupportFramework.git psf-src
          if ($LASTEXITCODE -ne 0) { Write-Warning 'PSF clone failed - falling back to NuGet'; exit 0 }

          Invoke-WebRequest 'https://dist.nuget.org/win-x86-commandline/v6.9.1/nuget.exe' `
            -OutFile nuget.exe -UseBasicParsing
          & .\nuget.exe restore "psf-src\CentennialFixups.sln"
          if ($LASTEXITCODE -ne 0) { Write-Warning 'PSF restore failed - falling back to NuGet'; exit 0 }

          # The projects pin the VS2019 toolset (v142); windows-latest ships v143.
          msbuild "psf-src\CentennialFixups.sln" -p:Configuration=Release -p:Platform=x64 `
            -p:PlatformToolset=v143 -m /v:minimal
          if ($LASTEXITCODE -ne 0) {
            Write-Warning "PSF build failed (exit $LASTEXITCODE) - falling back to NuGet"; exit 0
          }

          New-Item -ItemType Directory -Force -Path psf-bin | Out-Null
          foreach ($f in 'PsfLauncher64.exe','PsfRuntime64.dll','FileRedirectionFixup64.dll') {
            $src = Get-ChildItem -Path psf-src -Recurse -Filter $f -ErrorAction SilentlyContinue |
                   Where-Object { $_.FullName -match '\\x64\\Release\\' } |
                   Select-Object -First 1
            if (-not $src) {
              Write-Warning "PSF build did not produce $f - falling back to NuGet"
              Remove-Item psf-bin -Recurse -Force -ErrorAction SilentlyContinue
              exit 0
            }
            Copy-Item $src.FullName psf-bin\ -Force
          }
          Write-Host "PSF built from source into psf-bin (no Microsoft telemetry provider id)"

      - name: Build MSIX
        shell: pwsh
        env:
          VERSION: ${{ needs.check-version.outputs.version }}
          STORE_IDENTITY_NAME: ${{ secrets.STORE_IDENTITY_NAME }}
          STORE_PUBLISHER: ${{ secrets.STORE_PUBLISHER }}
        run: |
          if (-not $env:STORE_IDENTITY_NAME -or -not $env:STORE_PUBLISHER) {
            Write-Warning 'STORE_IDENTITY_NAME / STORE_PUBLISHER are not set: the package carries placeholder identity values and Partner Center would reject the upload.'
          }
          $msixArgs = @{}
          if ($env:STORE_IDENTITY_NAME) { $msixArgs.IdentityName = $env:STORE_IDENTITY_NAME }
          if ($env:STORE_PUBLISHER) { $msixArgs.Publisher = $env:STORE_PUBLISHER }
          if (Test-Path "$env:GITHUB_WORKSPACE/psf-bin/PsfLauncher64.exe") {
            $msixArgs.PsfBinDir = "$env:GITHUB_WORKSPACE/psf-bin"
            Write-Host 'Packaging with the from-source PSF binaries.'
          } else {
            Write-Warning 'From-source PSF unavailable: falling back to the NuGet package, whose binaries carry Microsoft''s telemetry provider id.'
          }
          & "$env:GITHUB_WORKSPACE/AgentBridge/tools/store/New-StoreMsix.ps1" `
            -PayloadDir "$env:GITHUB_WORKSPACE/payload" `
            -Version $env:VERSION `
            -OutDir "$env:GITHUB_WORKSPACE/store-msix" `
            @msixArgs

      - name: Upload MSIX
        uses: actions/upload-artifact@v4
        with:
          name: store-msix
          path: store-msix/*.msix

  release:
    needs: [check-version, build, store-msi]
    if: needs.check-version.outputs.do_release == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Download archives
        uses: actions/download-artifact@v4
        with:
          path: artifacts
      # Pin the tag to the commit that triggered this run (github.sha = the gate-off commit) so
      # a later master push (e.g. the IsPrerelease restore after a button release) cannot move
      # it. The GITHUB_TOKEN push does not re-trigger workflows. The tag is informational:
      # nothing listens on it.
      - name: Tag the triggering commit
        shell: bash
        run: |
          git tag "v${{ needs.check-version.outputs.version }}" "$GITHUB_SHA"
          git push origin "v${{ needs.check-version.outputs.version }}"
      # Creates the GitHub release (the tag already exists) with all 5 platform
      # archives + the Windows Store MSI when store-msi produced one (the job is
      # continue-on-error, so the archives release must not depend on it — an
      # absent MSI artifact just uploads the archives). generate_release_notes:
      # auto-notes from merged PRs/commits — every release ships with a changelog
      # (read by users and AI engines alike).
      #
      # `body` is PRE-PENDED to the auto-generated notes (softprops/action-gh-release:
      # "If body is specified, the body will be pre-pended to the automatically generated
      # notes"), so this is the per-release note. It MUST be updated in the gate-off
      # commit — see docs-dev/RELEASE-CHECKLIST.md: a stale note ships the previous
      # release's news to every user and to the AI engines that read release pages.
      - name: Create GitHub Release v${{ needs.check-version.outputs.version }}
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.check-version.outputs.version }}
          files: |
            artifacts/**/*.tar.gz
            artifacts/**/*.msi
          body: |
            ### Settings, rebuilt around separate panels

            The single tabbed "Main settings" window is gone. Settings now opens as focused
            panels — **LLM & Provider**, **Email (SMTP + IMAP)** and **General** — each with
            its own **Save** that closes only when its values validate, so a bad value in one
            area never blocks the others.

            ### Provider management is clearer

            The **active-provider dropdown** is now the single way to change which provider is
            active: pick one, press Save, and the choice persists across restarts. The active
            provider is marked **(attivo)** in the list, the dropdown and the list always agree,
            and the old "Set default" button is gone. **Edit** opens the provider selected in
            the list, and the API-key field shows the stored key masked.

            ### SIP telephony is now a real settings panel

            The SIP page used to be read-only. It is now a full editable panel: enable/disable,
            listen port, registrar, credentials, answer mode and PIN, plus call / hang-up /
            reload actions.

            ### Voice moved to the Session menu

            Voice starts a one-shot dictation, so it is no longer a "setting": it now lives
            under **Session**, alongside the model switch and session features. The TTS engine
            panel gained a **reset to default**.

            ### Documentation on the wiki

            The user guides now live on the GitHub wiki, kept in sync automatically from the
            repository. **Help → Documentation** (and `/docs`) opens
            https://github.com/Graphene-Lab/AgentBridge/wiki.
          generate_release_notes: true

  # Microsoft Store submission: once the release exists with the MSI attached, point the
  # Partner Center draft package at the VERSIONED MSI URL (the AIOffice VPS streaming proxy
  # answers 200 without redirects for /agentbridge/msi/<version>, which is pinned to release
  # tag v<version> and never changes — Partner Center rejects redirecting URLs and requires
  # a URL whose binary stays frozen, policy 10.2.9, see tools/store/vps/) and submit for
  # certification. The real gate is inside the run script (the secrets context is not
  # allowed in job/step if): the STORE_* secrets exist
  # only for accounts that could register the Entra app the Store API requires — individual
  # developer accounts have none, so the step exits early and the Store update is manual
  # (see tools/store/README.md "Manual fallback"); continue-on-error keeps the run green
  # in any case: the GitHub release is already out and a failed Store submission must
  # never look like a failed release.
  store-submit:
    needs: [check-version, store-msi, release]
    if: needs.store-msi.result == 'success'
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
        with:
          path: AgentBridge

      - name: Submit to Microsoft Store
        shell: pwsh
        env:
          VERSION: ${{ needs.check-version.outputs.version }}
          STORE_TENANT_ID: ${{ secrets.STORE_TENANT_ID }}
          STORE_CLIENT_ID: ${{ secrets.STORE_CLIENT_ID }}
          STORE_CLIENT_SECRET: ${{ secrets.STORE_CLIENT_SECRET }}
          STORE_PRODUCT_ID: ${{ secrets.STORE_PRODUCT_ID }}
          STORE_SELLER_ID: ${{ secrets.STORE_SELLER_ID }}
        run: |
          # The secrets context is not usable in if: conditions — gate on the env var
          # instead. Without the Entra app credentials (individual accounts) the Store
          # update stays manual (see tools/store/README.md "Manual fallback").
          if ([string]::IsNullOrEmpty($env:STORE_TENANT_ID)) {
            Write-Host 'STORE_TENANT_ID not configured - skipping Store submission (manual fallback).'
            exit 0
          }
          & "$env:GITHUB_WORKSPACE/AgentBridge/tools/store/Submit-Store.ps1" `
            -PackageUrl "https://aitechnology.it/agentbridge/msi/$env:VERSION" `
            -Version $env:VERSION